chore(security): 凭据治理收口 — 清除硬编码DB账号/口令，脚本与API统一从 backend/.env 读取(无明文兜底)；取消跟踪 .pyc 构建产物 (credential-governance-20260912)

2026-09-12 23:34:35 +08:00
parent 4f7058f1ea
commit b8f4a3d543
39 changed files with 131 additions and 18 deletions
@@ -3,11 +3,21 @@ import pymysql
 import os
 import logging

+# 2026-09-12 库访问治理（ops）：凭据从 backend/.env 读取，无明文兜底
+import os
+try:
+    from dotenv import load_dotenv as _ld_gov
+    _ld_gov('/root/cma-management/backend/.env')
+except Exception:
+    pass
+if not os.getenv('CMA_DB_PASS'):
+    raise SystemExit('ERROR: 缺少 CMA_DB_PASS（2026-09-12 凭据治理已移除明文兜底）')
+
 logging.basicConfig(level=logging.INFO)
 logger = logging.getLogger("encoding-cleanup")

 DB_USER = os.getenv("CMA_DB_USER", "cma_user")
-DB_PASS = os.getenv("CMA_DB_PASS", "cma_pass_2026")
+DB_PASS = os.environ["CMA_DB_PASS"]
 DB_HOST = os.getenv("CMA_DB_HOST", "127.0.0.1")
 DB_PORT = int(os.getenv("CMA_DB_PORT", "3306"))
 DB_NAME = os.getenv("CMA_DB_NAME", "cma")